function DecodeForwardedCert(r)
  local v = r.headers_in["X-SSL-CLIENT-CERT"]
  if not v or v == "" then
    return apache2.DECLINED
  end

  -- Decode %HH sequences, but drop %0A entirely
  v = v:gsub("%%(%x%x)", function(h)
    if h:lower() == "0a" then
      return ""  -- remove %0A
    else
      return string.char(tonumber(h, 16))
    end
  end)

  r.headers_in["X-TEST-PN"] = v
  return apache2.OK
end